Wireguard is recently making a splash as human-configurable low-overhead alternative to OpenVPN and IPSec. As some privacy-centric VPN providers are planning to support it (e.g., PIA) or already have a beta running (e.g., IVPN, as tested by Ars Technica) it was time for me to look into it. The Setup To get a better feeling about the used technology I directly connected my laptop to my desktop (gigabit Ethernet with no switch/router in between) and setup OpenVPN with a minimalist configuration as well as with a more realistic TLS-configuration.
I’ve wrote about about creating a simple wireless (WLAN for us right-pondian) http/https interception setup before. Mostly I’m using this as a first step when testing mobile/desktop applications. Linux’ network-manager is perfectly able to create an software access-point with most modern network cards. Alas GNOME’s configuration tool only allows for the creation of ad-hoc networks (and switching to KDE for just this is a bit overkill for me) so you have to setup the access point on the command line with nmtui or nmcli.
This year seems to bring a lot of changes: I’ve switched employers after staying on/off at a research center or the last twelve years. When I started there, I was doing cool network coding for the SECOQC quantum key distribution network, it somehow felt as being a part of some bigger undertaking that finally let to something. My work had a tenable outcome, this compensated for the long hours and poor pay.
Recently I’ve found an old post-it with guidelines I wrote myself a couple of years back, two of those stood out: make mistakes don’t buy stupid stuff Seems like I haven’t been the most consistent person back then. The post-it got discovered during a clean-up session of my flat, the same session brought up the following stupidly-bought-and-never-used gadgets: one BBC micro:bit that should be able to capture Bluetooth Low Energy transmissions one Proxmark 3 RV4 that should be able to do some nifty RFID stuff (and that I was recently able to fix) one Realtek Software-Defined Radio USB Stick (rtl-sdr).
I have a quite simple setup: Fedora 23 on my Desktop, Ubuntu 16.04 on my Notebook and a YubiKey thrown into the mix. I do have my normal GnuPG key DD436203 that I’m using. There’s also an old and revoked key 3F5D00B6 with which I was testing my YubiKey with (note to myself: don’t use an YubiKey-crested private key as you cannot backup it). My main key offers an ElGamal 2048bit subkey – which does not work with the Yubikey (as that only supports 2048bit RSA).
Update 2017: Sadly I found out (thanks due to the comments on this blog post) that using port-share does not encapsulates subsequent traffic in normal TLS. So using this method will not fool Deep-Package Inspection Firewalls. If you need to mask all your traffic, this is not an option – you might need to investigate stunnel, information can be found here, here or here. I assume, that the higher success rate of this method could be related to some firewalls checking the target of the initial https request.
One important part of the European Prismacloud project is dissemination: make ordinary people understand some of our cryptographic directives. Out of this, the following clip originated: The technique in question is called secret-sharing and was originally detailed in 1979.
Firejail describes itself as a SUID program that reduces the risk of security breaches by restricing the running environment of running programs. We’ll just call it chroot or jail (for the BSDers out there).So, it’s SUID? First things first: it’s SUID, so if there’s an error within the firejail binary an attacker can gain root rights. This comes with the territory. How large is Firejail and how many dependencies does it have?
Keeping a good security and privacy is tough work. There’s always a trade-off between effort and achieved security. In this blog post I’ll mention small things that a ``normal” person should be able to perform — that still increase the overall security of that user’s data. Choose your Liege Bruce Schneier talks about the comeback of feudal security: you choose your liege lord and depend upon him for providing security.
I have just received my OSCP exam success notification. This is a penetration-testing certification by Offensive Security with focus on hands-on-training.You get an eBook and a week’s worth of video lectures with guided exercises; access to a virtual lab with approximately 55 machines that you should gain full control over and will finish with an 24 hour exam in which you are supposed to root five target machines. All this should be documented and submitted at last 24 hours after your exam is over – my documentation had 264 pages.